Executive brief
The Open ISES Project (also known as Tickets CAD) is an open-source computer-aided dispatch system used by emergency services and volunteer organizations to manage incidents and responders. A security flaw in the software allows unauthorized individuals to access the underlying database without a password. This could lead to the theft of sensitive emergency response data, personnel records, and system configuration information.
Technical details
An unauthenticated SQL injection vulnerability exists in The Open ISES Project version 3.30A and potentially earlier versions. The flaw is located in the 'p1' parameter of the 'city_graph.php' component, which fails to properly sanitize user-supplied input before using it in a database query. An attacker can exploit this by sending a specially crafted GET request to the vulnerable endpoint. Successful exploitation allows for the extraction of sensitive information from the database, including schema names, user credentials, and incident data. Additional endpoints such as 'sever_graph.php', 'inc_types_graph.php', and 'nearby.php' have also been identified as potentially vulnerable to similar injection techniques.
Affected products
- The Open ISES Project The Open ISES Project (Tickets CAD) 3.30A and earlier
Timeline
- 2018-10-18: disclosed: Initial discovery and proof-of-concept published by security researcher
- 2026-05-29: advisory: CVE-2018-25403 published/updated in NVD